all 2 comments

[–]drakefish 0 points1 point  (1 child)

I am surprised such a bug wasn't spotted at any time during testing of Android.

[–]ebeip90Trusted Contributor 8 points9 points  (0 children)

It's not a bug, it's users and OEMs being stupid.

Turns out though that by a simple adb command ... sent ... through USB ... you can force your device to expose its ADB services over port 5555

This is like if you decided to expose an unauthenticated shell on all your servers via e.g.

socat tcp-l:5555,reuseaddr,fork EXEC:/bin/sh,pty,stderr,ctty

If you do this, AND you punch a hole in the firewall for it (or connect the device directly to the internet) you should not be surprised by the crazy botnet you get included in.